What are smart accounts, and what do ERC-4337 and EIP-7702 change?

The trouble with plain accounts

Most people use Ethereum through externally-owned accounts, which are simply a public and private key pair.² With the private key you can do anything; without it you can do nothing.² Plain accounts also make it hard to batch transactions, and you always need some ETH to pay fees.²

What a smart account adds

Account abstraction lets people program extra security and convenience into their accounts.² The result is a smart contract wallet, also called a smart account.^2,1 ethereum.org lists what this allows.²

• Recovering an account if you lose your keys.²
• Sharing an account's security across trusted devices or people.²
• Paying someone else's gas, or having someone pay yours.²
• Batching actions, such as approving and making a swap in one go.²

ethereum.org also mentions wallet rules such as needing several signatures for large payments, or only paying trusted addresses.² A multisig like Safe is one kind of smart account.¹

ERC-4337: no change to Ethereum's core

ERC-4337 is a standard for account abstraction that needs no change to Ethereum's core consensus rules.³ Its status on the official EIPs site is Final.³ It adds some new parts.³

• UserOperation. A request describing a transaction to be sent on a user's behalf. It is deliberately not called a "transaction".³
• Bundler. A node that takes UserOperations from a separate waiting area, called a mempool, and packs them into one real transaction.³
• EntryPoint. One shared contract that carries out these bundles.³ It went live on Ethereum mainnet on 1 March 2023.²
• Paymaster. A helper contract that agrees to pay the fee instead of the user.³

The standard does not fix what a valid signature looks like. Each account's own code decides.³ So an account can use different signature schemes, a multisig setup or its own recovery rules.³

A Safe can be turned into an ERC-4337 account by enabling Safe's ERC-4337 module, which also acts as its fallback handler.⁵

EIP-7702: ordinary accounts get code

Ethereum's Pectra upgrade went live on 7 May 2025.⁴ One of its changes, EIP-7702, lets an ordinary account run code like a smart contract.⁴ That opens up batching, gas sponsorship, spending controls and account recovery for ordinary accounts.⁴

It works by pointing the account at contract code that is already on the chain.⁶ The owner signs an authorisation, and a new type of transaction sets the pointer.^6,7 The pointer can be cleared by pointing it at the null address.⁶

One aim is to let users hand out sub-keys with limited powers, much weaker than full control of the account.⁷

The catch: the old key still rules

Delegation does not take power away from the original key. ethereum.org says the private key keeps full control of the account.⁶ So pointing an account at a Safe does not make it a multisig. One key can still bypass any signing rules.⁶ Safe's own documentation says the key can even change the delegation, so it must be kept secure.⁸

Delegation is also a new way to be tricked. If someone delegates their account to a malicious contract, an attacker could take control and steal funds.⁶ The EIP's authors warn that few users can properly check the code they are delegating to.⁷